Mastodon
sungate.co.uk

sungate.co.uk

Ramblings about stuff

Network worms and Hansol’s excuse …

Firstly, Hansol’s excuse. Apparently, the monitor did go out on the correct date, but the courier decided to ignore most of the address and just went to the reception desk of the hospital, rather than using the Department Name, Organisation Name and Building Name he had been given. At the main reception desk he probably announced that he “had a monitor for Dave”. Expletive.

Can’t really blame Hansol for it, ‘cos when they resent the monitor the next day, they used a different (and considerably more clueful) courier.

And it’s nice having a proper monitor again, of course. Anyway, on to the rant …

The W32/Nachi
network worm is not particularly unusual, but it has caused complete havoc to my workplace network, and indeed to the entire organisation. Despite the fact that our
department is not running any susceptible systems, we have been suffering the effects of the worm since Wednesday 10 September, because a handful of infected machines at Head Office have been flooding the corporate networks with “ping” traffic. This easily
overloads our very-low-bandwidth connection and has meant that we’re effectively offline for hours at a time. Not fun.

Now, as soon as I was made aware that there was a worm running around the organisation, I analysed the network traffic and identified about a dozen (yes, only 12) infected desktop PCs at Head Office – I sent them a list of the machines. This took about an hour. I was hoping this information would be redundant and that they would already be On The Case, but even if they weren’t, this would be enough for someone at Head Office to solve the problem.
“Great”, I thought, “it won’t take them long to walk around the affected departments and switch off the infected machines, or at least disconnect them from the network. Our network will be back to normal by the end of the day.”

You can see where this is heading can’t you?

It has taken until today, almost one week later, to get the infected
machines offline. I can only assume that no-one cared sufficiently about us poor little outlying departments and they didn’t see it as a priority. Thing is, of course, it should have taken one person less than an hour to walk around the departments with
infected machines and switched them off and/or disconnect them from the network, so that the network flood would stop. Grrr. Amusingly, I had access to information which indicated the names and telephone numbers of the owners of all infected machines and, after a couple of days without any progress from Head Office, I was sorely tempted to call them up individually (wouldn’t have taken long) and talk them through the procedure for fixing their own systems, but in the end I figured that the IT Department would consider that totally out of my jurisdiction and make life difficult for me in the future. But hey,
it would have got a department of 60 people back on the network again a number of days before the IT Department managed it.

I recounted the above story to our head of department, an emminent professor, and she was sufficiently horrified at the lack of service from Head Office IT People that she has
suggested that I draft a “Letter Of Bollocking” to the Head of IT.

That could be interesting.